CVE-2023-36915

What it actually does

Integer overflow during chain_table array allocation in FST reader allows memory corruption that can result in arbitrary code execution when parsing a crafted file.

Why it matters to the business

Compromise of user workstations or build systems occurs when a malicious file is opened, with high urgency due to available exploits and over 1000 days of exposure; Debian freeipa packages require immediate updates across many environments.

How an attack unfolds

An attacker crafts an FST file that triggers an integer overflow in the chain_table allocation path; the victim opens the file in the vulnerable application, causing memory corruption that is turned into code execution. Public exploits exist and named threat actors have shown interest in similar memory corruption issues.

How to fix it

Upgrade freeipa on Debian 13 and 14 to version 4.12.2-1 or later; apply vendor patches for GTKWave 3.3.115 and later; verify all downstream dependents are updated given high ecosystem prevalence.

How to confirm the fix worked

Confirm application version is at or above the fixed release; test opening of known-good and crafted FST files in a sandbox to verify no crash or corruption occurs; review package manager output for successful upgrade to 4.12.2-1.

Typical attack path

1. Craft malicious .fst file exploiting chain_table integer overflow
2. Deliver file via email, download, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Overflow leads to memory corruption and attacker-controlled code execution

How to detect it

Review file-open logs and process creation events for GTKWave or freeipa-related binaries handling .fst files; look for crashes or unusual memory allocations shortly after file access; check for any known threat actor tooling associated with similar FST parsing flaws.

• Process name: gtkwave
• File extension opened: .fst
• Crash signatures in application logs referencing chain_table allocation

What your security team should do

• Immediately update all affected freeipa installations to 4.12.2-1 on Debian 13 and 14
• Block opening of untrusted .fst files and enforce sandbox execution for file viewers
• Monitor EPSS trend and exploit availability; prioritize patching given ExploitAvailable status
• Scan for presence of older GTKWave or dependent packages across the environment